Controls intervene at different points

A control intervenes at a particular point in a mechanism. A prevention measure changes whether the loss event occurs. A mitigation measure changes its consequence if it occurs. Operating support determines whether those measures can function as supplied. Their names in a register do not establish these relationships. An activity called prevention may primarily improve response after an interruption; an activity called resilience may affect both occurrence and recovery. The analyst should describe the causal effect before choosing the field in which to enter it.

The shared-support example is designed to test nominal diversity. Prevention and mitigation appear as different control functions, but both depend on a common availability state. They are jointly absent in the unavailable state and jointly applicable in the available state. Crediting each function's average performance separately can accidentally distribute the support failure across different events. The resulting model can look more diversified than the stated mechanism. That error does not require a sophisticated correlation model to detect. It requires keeping the common operating state visible while calculating the expectation.

The canonical expression weights the gross-loss factor in the unavailable state and the combined prevention-and-mitigation factor in the available state. In notation, with annual gross event chance p, event loss I, shared availability r, conditional prevention a and conditional mitigation b, the residual expectation is p × I × [(unavailable weight) + r × (remaining prevention factor) × (remaining mitigation factor)]. The unavailable weight is the complement of r. The remaining factors are the complements of a and b. The expression represents the supplied joint-state mechanism; it is not an estimate of an actual control architecture.

A tempting shortcut is to reduce prevention and mitigation separately by average availability and multiply their remaining marginal factors. That shortcut gives another mathematical model. It is not generally the same as the shared-state mixture. The shortcut implicitly permits combinations in which the effect of one function is present while the other function's average effect is absent, even when the stated common operating support would switch both together. It can therefore understate the loss associated with common unavailability. The correct question is not whether the shortcut is simpler, but whether it matches the supplied causal architecture.

The deliberately separate marginal-surrogate fixture makes the difference reproducible. Its inputs are not asserted to be the original mechanism's effective parameters. They describe an all-available model with reduced conditional effects, chosen to represent the tempting marginal substitution. The engine correctly calculates that separate fixture. Comparing its result with the original shared-support fixture reveals a mechanism mismatch, rather than a computation error in the engine. This distinction matters because an exact output from an inappropriate input model can still mislead a committee.

Boundary cases are a powerful diagnostic. If shared support is always unavailable, the supplied controls cannot reduce the event probability or severity under this mechanism. If support is always available, the conditional prevention and mitigation effects apply without the support mixture. These limits help the reviewer inspect the meaning of the fields. A formula that credits protection in the always-unavailable case has departed from the supplied mechanism. A formula that fails to apply the conditional effects in the always-available case also needs explanation. Boundary tests should be retained alongside the central scenario.

The source mechanism yields USD 92.00 thousand in residual annual expectation, while the separate marginal-surrogate fixture yields USD 72.80 thousand. The surrogate therefore receives a HOLD as an interpretation of the original shared-support architecture. Its arithmetic is correct for its own supplied fields. The disposition rejects the substitution, not the engine result. A model reviewer should be able to make that distinction without disputing an output merely because it appears too favourable.

Illustrative. The boundary fixtures yield residual expectation of USD 200.00 thousand when support is unavailable and USD 20.00 thousand when support is available. They retain the same gross event and conditional efficacy inputs. The unavailable boundary still incurs its declared annual control cost and therefore has net annual control value of USD -30.00 thousand. Paying for a capability is not equivalent to that capability being available. A service package that cannot provide the necessary support should be reconsidered at its dependency, not defended by pointing to a control budget.

A dependency should be investigated at the level where it changes the response. The common state may be an electric supply, a competent operator, a communications link, a maintenance regime or another support capability. The demonstrator compresses that dependency into an availability input. It does not identify the real support capability or distinguish several partial states. If different support failures affect prevention and mitigation differently, the supplied common binary state may be too coarse. The institution should then model the relevant states explicitly rather than interpret a more detailed narrative through an unchanged binary parameter.

Controls can also interact within a state. A prevention measure may change the type of events that remain, which can change the mitigation performance for those events. The simple supplied model applies fixed conditional prevention and mitigation reductions within its available state. It does not estimate that selection effect from operating data. An analyst using the mechanism in practice should ask whether the mitigation evidence applies to the residual event population after prevention. If it applies only to easier events that prevention removes, the fixed conditional effect can be optimistic even when the common availability treatment is correct.

Control resources deserve the same causal discipline. A monitoring team, spare-parts stock or service contract may support availability rather than directly change severity. Assigning its cost to a prevention percentage can conceal what the organisation is buying. The response proposal should identify the capability being changed, the evidence for the proposed change and the recurring resources needed to sustain it. In the frozen availability-repair case, the model changes shared availability and annual cost while retaining the other event and conditional-control inputs. That isolates an intervention for comparison. It does not establish that a real supplier can deliver that change.

An intervention should be tested against a plausible adverse answer. If availability improves but the cost becomes too high for the optional economic condition, the response should be rejected or redesigned under that condition. If a mandatory safety or service requirement demands protection regardless of optional annual value, the proposal needs an explicit different mandate. If the claimed improvement cannot be evidenced, implementation should be held. These branches prevent the model from becoming a device for defending the originally preferred control. They also separate the controlled calculation from the organisational reason for acting.

The committee should resist rewarding nominal control count. Several activities can depend on the same person, supplier, power source or information feed. Conversely, a single activity can create genuinely separate protections when its architecture and failure modes support that claim. A register's number of controls therefore provides no automatic diversity measure. The relevant record is the dependency map and the consequence of its adverse states. The all-unavailable fixture is intentionally severe as a boundary, but its role is to test whether the calculation preserves that dependency, not to assert that complete support failure is likely.

A practical intervention comparison should preserve the baseline input hashes and state exactly what changes. This protects against a common appraisal drift in which a proposed control appears beneficial because the analyst quietly also lowers the gross event probability or severity. A response may legitimately change several fields, but then its evidence burden includes each claimed change. The isolated availability study retains the original gross event and conditional effects. Its improvement can therefore be attributed within the stipulated model to the declared availability change, with a separate annual resource cost. That attribution is analytical, not empirical proof of deliverability.